Executive brief
Omnigent is an AI agent framework that allows users to upload custom agent configurations. An authenticated user can upload a malicious configuration that invokes dangerous Python functions (like subprocess.check_output) on the server's runner environment, leading to arbitrary command execution. In hosted multi-user deployments, this allows a normal user to execute code with runner privileges, potentially exposing credentials, workspace data, and internal services.
Technical details
This is a code injection vulnerability (CWE-94) in Omnigent's agent bundle validation. The vulnerability occurs in the trust boundary between uploaded user bundles and trusted operator features. The server's validate_agent_bundle() function disables environment expansion and can enforce policy-handler allowlists, but it does not reject tools.<name>.callable entries. Later, _resolve_spec_callable() uses importlib.import_module() to dynamically import and execute the callable at the dotted path specified by the user, such as subprocess.check_output. An authenticated user can exploit this by uploading a crafted bundle via POST /v1/sessions with a tool callable pointing to any importable Python function. No user interaction or special privileges are required beyond initial authentication. The fix was to reject callable: tool paths for tenant-uploaded bundles unless explicitly allowlisted by the operator.
Affected products
- omnigent-ai omnigent < 0.3.0
Timeline
- 2026-06-29: disclosed
- 2026-09-02: patched: Version 0.3.0 released with fix
- 2026-09-02: advisory